Api Basics

Before You Start

Read the following guides before proceeding:

Guide	Why
Environments	API base URLs per environment

Required Headers

With a Corporation Token

Everything the request needs about identity and chain is inside the token.

Header	Value	When Required
`Authorization`	`Bearer <corporation_token>`	Every corporation-scoped endpoint
`Content-Type`	`application/json`	Requests with a JSON body

Sending X-Chain-Id alongside a corporation token has no effect — the chain is read from the token's
chain_id claim.

With a Partner Token

Header	Value	When Required
`Authorization`	`Bearer <partner_token>`	The four partner endpoints
`X-User-Wallet`	Employee EOA address	Required by `corporations/register` and `corporations/login`
`X-User-Email`	Employee email address	Required by `corporations/register` and `corporations/login`
`X-User-Id`	Employee id (UUID)	Accepted as an identifier by `employees/corporations`
`X-Chain-Id`	Chain id	Optional; defaults to the environment's default chain
`Content-Type`	`application/json`	Requests with a JSON body

See Authentication for the flows and Auth Tokens
for every token type and what it unlocks.

Access Control

Every corporation-scoped endpoint declares the permissions that admit a caller. The permission set is
resolved from the employee's role at login and frozen into the token.

See Permissions for the endpoint-by-endpoint matrix.

API Versions

Prefix	Contents
`/api/v1/`	The base surface — corporations, employees, roles, wallets, cards, recipients, activity
`/api/v2/`	Card issuance with a `delivery_id` fee invoice, recipient creation with payment details in one call, and a bank transfer estimate that accepts inline recipient details
`/api/v3/`	Corridor transfers — one estimate/initiate/confirm flow covering every payment rail

A v2 endpoint does not deprecate its v1 counterpart. Both remain callable; pick one flow per
integration and follow it end to end.

Pagination

List endpoints take the same query parameters:

Parameter	Description
`page_number`	1-indexed page number
`page_size`	Page size. Defaults to 25 when omitted; maximum 50
`sort`	`name` for ascending name order (default), or `usage` for descending usage count

A page_size above 50 is rejected with 400 ErrorInvalidField and page size exceeds maximum allowed.
GET /api/v1/employees/search is the exception — it has its own limit of 100.

Amounts

Money crosses the API in two forms, and every estimate response carries both:

Form	Meaning
`amount`	A decimal number in the currency's or token's own precision, e.g. `109.41123037`
`precise_amount`	A string holding the integer amount in the token's smallest unit, e.g. `"109411230370000000000"`

Use precise_amount for on-chain transfers. The exponent is the token's decimals from
GET /api/v1/config/tokens.

Network Requirements

All requests use HTTPS with TLS 1.2 or later
Validate SSL certificates in production
Recommended request timeout: 30 seconds
Webhook delivery uses a 10 second timeout

IP allowlisting is available for POST /api/v1/token. Registering your egress addresses also exempts
your client from the per-client rate limiter on that endpoint. Contact Wirex to configure it.

Webhooks

Wirex delivers notifications for corporation, wallet, balance, card, 3DS, activity, recipient and
withdrawal changes to the webhook base URL registered during onboarding.

See Webhooks for endpoint paths, payloads and the delivery contract.